Skip to content
Scams Exploit Placeholder Domains in AI Agent Skills

Scams Exploit Placeholder Domains in AI Agent Skills

First seen 27 Sep 2026, 19:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 27, 2026 at 19:57 UTC
  • •Two placeholder domains redirect macOS users to scams.
  • •Static checks failed to detect malicious redirects due to JavaScript execution.
  • •The issue affects 359,000 GitHub files and 349 AI agent skills.

Manifold Security discovered that unreserved placeholder domains, specifically yoursite.com and your-domain.com, are redirecting macOS users to scams. These domains, found in 359,000 GitHub files and cited by 349 AI agent skills, serve cloaked scam redirects without any changes to the original code. Researchers tested these domains across 24 real-browser sessions, where two visits led to scam pages while others ended on parking or ad pages. The scams included a fake 'MacOS Security Center' warning and counterfeit news articles promoting investment schemes. Static checks failed to identify the malicious redirects, which only activated after JavaScript execution in a real browser. This issue highlights the risks associated with using non-reserved domains in software documentation. The findings follow a previous disclosure about another placeholder domain, third-party.com, which was turned into a ClickFix lure targeting Windows users.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-23
Disclosure of third-party.com scam
Manifold Security reported that third-party.com was turned into a ClickFix lure targeting Windows users.
Hackread
2026-09-26
Hackread article published
Hackread published findings on placeholder domains redirecting to scams, detailing the methods used.
Hackread
2026-09-27
Manifold Security report published
Manifold Security released a detailed report on the scams linked to placeholder domains, confirming their findings.
Manifold Security

More articles in this cluster (2)

Following this threat?

Track ClickFix and Manifold Security in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (22)

1 / 3